Exploiting Document Templates: Stego-Campaign Deploying Remcos RAT and Agent Tesla
Excerpt
RAT and Agent Tesla - CYFIRMA
Published On : 2024-03-05
EXECUTIVE SUMMARY
At CYFIRMA, our commitment is to provide timely insights into prevalent threats and malicious tactics affecting both organizations and individuals. Our research team recently identified a malicious .docx file linked to the stego-campaign, revealing a sophisticated cyber threat.
This campaign utilizes template injection in a Microsoft Office document to bypass traditional email security measures. Upon opening the document, a multi-stage attack is triggered, involving the download and execution of sc…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by cyfirma.com on cyfirma.com.
Mentioned in the excerpt1
On the same topics
acronis.com · Web page · Published 13 Sep
Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit
Acronis Threat Research Unit (TRU) uncovered a multinational campaign in which a Chinese-speaking threat actor, tracked as Red Heron, rapidly weaponized CVE-2026-60004 to compromise internet-facing instances of Gitea, a self-hosted source-code management…
QiAnXin · Web page · Published 11 May
Threat Actor Mr_Rot13 Actively Exploits CVE-2026-41940 for Backdoor Deployment
CVE-2026-41940 is a high-severity unauthenticated authentication bypass vulnerability affecting cPanel & WHM. This product is widely used in Linux server operations and virtual hosting management. The vulnerability has a CVSS score as high as 9.8 (Critical).…
BleepingComputer · Web page · Published 11 Oct
Nemty 1.6 Ransomware Released and Pushed via RIG Exploit Kit
The RIG exploit kit is now pushing a cocktail of malware that includes a new variant of the Nemty Ransomware. First spotted by exploit kit researcher mol69, a malvertising campaign is redirecting users to the RIG exploit kit to target enterprise users who are…
Check Point · Web page · Published 31 Jul
Osiris: An Enhanced Banking Trojan
Following our recent analysis of the Kronos banking Trojan, we discovered that Kronos has also now been enhanced to hide its communication with C&C server using Tor. While the author of Kronos continues to remain an issue of controversy, the new banking…